use plain objects, closes #74 closes #80

README.md

@@ -23,7 +23,7 @@ var str = Qs.stringify(obj);  // 'a=c'
 Qs.parse(string, [options]);
 ```
 
-**qs** allows you to create nested objects within your query strings, by surrounding the name of sub-keys with square brackets `[]`.
+**qs** allows you to create nested objects within your query strings, by surrounding the name of sub-keys with square brackets `[]`, or prefixing the sub-key with a dot `.`.
 For example, the string `'foo[bar]=baz'` converts to:
 
 ```javascript
@@ -34,6 +34,13 @@ For example, the string `'foo[bar]=baz'` converts to:
 }
 ```
 
+The parsed value is returned as a plain object, created via `Object.create(null)` and as such you should be aware that prototype methods do not exist on it and a user may set those names to whatever value they like:
+
+```javascript
+Qs.parse('a.hasOwnProperty=b');
+// { a: { hasOwnProperty: 'b' } }
+```
+
 URI encoded strings work too:
 
 ```javascript

lib/parse.js

@@ -55,12 +55,13 @@ internals.parseObject = function (chain, val, options) {
 
     var root = chain.shift();
 
-    var obj = {};
+    var obj;
     if (root === '[]') {
         obj = [];
         obj = obj.concat(internals.parseObject(chain, val, options));
     }
     else {
+        obj = Object.create(null);
         var cleanRoot = root[0] === '[' && root[root.length - 1] === ']' ? root.slice(1, root.length - 1) : root;
         var index = parseInt(cleanRoot, 10);
         var indexString = '' + index;
@@ -101,12 +102,6 @@ internals.parseKeys = function (key, val, options) {
 
     var segment = parent.exec(key);
 
-    // Don't allow them to overwrite object prototype properties
-
-    if (Object.prototype.hasOwnProperty(segment[1])) {
-        return;
-    }
-
     // Stash the parent if it exists
 
     var keys = [];
@@ -120,9 +115,7 @@ internals.parseKeys = function (key, val, options) {
     while ((segment = child.exec(key)) !== null && i < options.depth) {
 
         ++i;
-        if (!Object.prototype.hasOwnProperty(segment[1].replace(/\[|\]/g, ''))) {
-            keys.push(segment[1]);
-        }
+        keys.push(segment[1]);
     }
 
     // If there's a remainder, just add whatever is left
@@ -141,7 +134,7 @@ module.exports = function (str, options) {
         str === null ||
         typeof str === 'undefined') {
 
-        return {};
+        return Object.create(null);
     }
 
     options = options || {};
@@ -153,7 +146,7 @@ module.exports = function (str, options) {
 
 
     var tempObj = typeof str === 'string' ? internals.parseValues(str, options) : str;
-    var obj = {};
+    var obj = Object.create(null);
 
     // Iterate over the keys and setup the new object
 

lib/stringify.js

@@ -38,7 +38,7 @@ internals.stringify = function (obj, prefix, generateArrayPrefix, strictNullHand
     }
     else if (obj === null) {
         if (strictNullHandling) {
-            return encodeURIComponent(prefix);
+            return Utils.fixedEncodeURIComponent(prefix);
         }
 
         obj = '';

lib/utils.js

@@ -8,7 +8,7 @@ var internals = {};
 
 exports.arrayToObject = function (source) {
 
-    var obj = {};
+    var obj = Object.create(null);
     for (var i = 0, il = source.length; i < il; ++i) {
         if (typeof source[i] !== 'undefined') {